Wireshark-users: Re: [Wireshark-users] TCP packets are labelled "Continuation to #xx"

From: Oguzhan Filizlibay <oguzhanf@xxxxxxxxxxxxx>
Date: Thu, 5 Jul 2007 23:35:15 +0100

Use the Follow TCP Stream feature under the Analyze menu for getting the whole stream of data being transferred. Continuation packets include the data to be sticked to the previous packets so you will not be able to see them as one packet. What you are asking for could be confused with jumbo packets.

Oguzhan

-----Original Message-----
From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Ahmed A
Sent: 05 Temmuz 2007 Perşembe 19:19
To: wireshark-users@xxxxxxxxxxxxx
Subject: [Wireshark-users] TCP packets are labelled "Continuation to #xx"

Hello,

I am capturing iSCSI traffic, but I believe my
question/request is applicable to any protocol.

I am getting some tcp packtes, in display column
"Info", are marked as "[Continuation to #xx]...".  I
get a few of these right after a "valid" tcp packet.
As an example:

64....iSCSI  Login Command
65....TCP    [Continuation to #64]....
66....TCP    [Continuation to #64]....

When I look at packet #64 in the middle window, I can
see all the fields expanded/decoded properly.
However, when I look at packet #65 or #66, ethereal is
not able to decode the packet, but when I scan byte by
byte in the third window, I can see what I am looking
for.  Is there anyway, I can make Ethereal compress
packet #64,#65,#66 into one single packet.

Regards,
Aha.




____________________________________________________________________________________
Choose the right car based on your needs.  Check out Yahoo! Autos new Car Finder tool.
http://autos.yahoo.com/carfinder/
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users